From nobody Fri Apr 3 04:37:59 2026 Received: from sender-of-o57.zoho.eu (sender-of-o57.zoho.eu [136.143.169.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C8F893C5DB6 for ; Tue, 24 Mar 2026 22:50:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.169.57 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392617; cv=pass; b=JiMk7orN+eN6MPUZBZXxlvhYA2/HiooNFF6wpNXuGBIw1OIkGXmJfffemm3d+tZ9WcHBE9iNc5i0jaqYhFycaRqPrAZQRaDNMwAgSzE/k3LISFXvKtJwG1O9oE0L/+AkiANjJdamdzteQ1eRKvjre7vOF5q+Zo1lPB+J/l2aNUY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774392617; c=relaxed/simple; bh=Zb+DD/8aPIY9FcDPOazctNoof0ZotU7WyO7WyK2XV9A=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=s7w25sTWmme7uYvrHZ3BPO1LzgEFKwiEZdWuOY0gOMx0K0/OVME63TBsv+zRKj846Syx4Yz9yhQK3nQ7qxT109sIL1tauaPJ8tpDzIya2PSGX3M+/tjlIhIrBDY72UZAH6PVbDG0LnHX/EjKE7F1BjfxJnGUMGAWUx5pNDaiaDE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org; spf=pass smtp.mailfrom=objecting.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b=dM/97SYX; arc=pass smtp.client-ip=136.143.169.57 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=objecting.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=objecting.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=objecting.org header.i=objecting@objecting.org header.b="dM/97SYX" ARC-Seal: i=1; a=rsa-sha256; t=1774392584; cv=none; d=zohomail.eu; s=zohoarc; b=csKRhv9CzVohcq8gUme8e6TfNU0D8oHglFbtP4iTJmrOnJXxRemr1WnDV0lP/RaCGNtaaFRNfZMo90PlFBPfrG38+YiVWj/aByWviOHFOWMu5Ck9AobiphdwHttMv6tl3XFkcX7WBSKXCQV4Sf6s8vWFERq4xZ8noNVZab8j6XI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1774392584; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=Rwl7GglhzJT2BAuJqF7KW6FMwMdHiz/ULto5LIlyZGk=; b=epIly9tCFQ15p9A+3WEu9PHfBM6Kgu43F52hhvj3JD25WoCiBAAe/MQDQ216foY84EvIE9B7u6TKqYL/l0Hw+GlSIoOtsmpZaoLxLHGnANwycRbWfSLDr8z+0EqIkPldRRHqg+AFNI2llr3KjbzBE9bkph+065swfHrg/KdPD8g= ARC-Authentication-Results: i=1; mx.zohomail.eu; dkim=pass header.i=objecting.org; spf=pass smtp.mailfrom=objecting@objecting.org; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1774392584; s=zmail; d=objecting.org; i=objecting@objecting.org; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-Id:Message-Id:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Reply-To; bh=Rwl7GglhzJT2BAuJqF7KW6FMwMdHiz/ULto5LIlyZGk=; b=dM/97SYXoRifC5WMSvwlcipUImLDUv/s1lwM3iNo5o8FvHpWCxFEZTF+RZAi1YfX fPvs9CxvEr2af3dX2ipvvMR5JL4V7H/p3cLfKOpgHkgQAsp2Ulw/eHL4TlB31AJxUIf 79EoWbIQWGUZI8xeGZIYW+Qel+dDEykHgg/jQzW4= Received: by mx.zoho.eu with SMTPS id 1774392582384220.1921176354116; Tue, 24 Mar 2026 23:49:42 +0100 (CET) From: Josh Law To: Petr Mladek , Steven Rostedt Cc: Andy Shevchenko , Rasmus Villemoes , Sergey Senozhatsky , Andrew Morton , Josh Law , linux-kernel@vger.kernel.org Subject: [PATCH 1/4] lib/vsprintf: always advance args in bstr_printf() pointer path Date: Tue, 24 Mar 2026 22:49:37 +0000 Message-Id: <20260324224940.50508-2-objecting@objecting.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260324224940.50508-1-objecting@objecting.org> References: <20260324224940.50508-1-objecting@objecting.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" When the output buffer is full (str >=3D end), bstr_printf() skips advancing the args pointer past the pre-rendered pointer string in bin_buf. This causes all subsequent format specifiers to read from the wrong position, corrupting the rest of the output. Always compute the string length and advance args regardless of whether there is space to copy into the output buffer. Signed-off-by: Josh Law Reviewed-by: Petr Mladek --- lib/vsprintf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 800b8ac49f53..7898fb998b21 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -3389,14 +3389,15 @@ int bstr_printf(char *buf, size_t size, const char = *fmt_str, const u32 *bin_buf) break; } /* Pointer dereference was already processed */ + len =3D strlen(args); if (str < end) { - len =3D copy =3D strlen(args); + copy =3D len; if (copy > end - str) copy =3D end - str; memcpy(str, args, copy); - str +=3D len; - args +=3D len + 1; } + str +=3D len; + args +=3D len + 1; } if (process) str =3D pointer(fmt.str, str, end, get_arg(void *), spec); --=20 2.34.1